Alternative authentication and access control for Request a Copy

[MrkGrgsn]

I want to get some feedback on a change we are thinking of making to Request a Copy approvals, mainly whether this change would be desirable for eprints core, perhaps as a configurable option.

We want to increase the number of copy requests that use the mediated request approval process. By 'mediated process' I mean the process where the contact person uses a form in the repository to approve/reject the request and EPrints then delivers the full text. This all based on knowledge of 3.2.

In summary the changes will:

• use the EPrints mediated process for all requests (i.e., never ask the contact person to contact the requester directly) even when the contact email address does not match a current user
• use a secret communicated via the email (I'm thinking a long random string or a hash of request metadata including a random part as an argument for the approve/reject URLs) to the contact email address to provide access to the approve/reject form without any further authentication/access control

The drivers are various QUT environmental factors which may or may not be generally applicable.

• The success rate for the direct contact/unmediated process is low (author's don't understand it, or they don't want to provide the full-text again, or they don't have the full-text anymore).
• QUT ePrints authenticates users via QUT's single-sign-on only and doesn't allow users without a QUT account to use the mediated process.
• Authors may use a non-QUT email address (it's their preference or because they leave QUT) as the contact email address but this forces the unmediated process.

This new behaviour could be an alternative to the current behaviour and switched on/off via config.

If you think this would be a welcome addition to core, we'll implement it that way and make a pull request, otherwise we'll do it as an extension/Bazaar package.

[MrkGrgsn]

Moved to the dev forum